Security Bug. How to stop execution php in double extension

[Eremiya]

Hello,

How to stop execution files in PHP with double extension (ex. somefile.php.txt and other)?

 

[jackc]

<FilesMatch "\.(php|inc|php3|php4|phtml|php5)$">

</FilesMatch>

 

[Eremiya]

I just add this to httpd.conf:

<FilesMatch "\.(php|inc|php3|php4|phtml|php5)$">
Order allow,deny
Deny from all
</FilesMatch>

But PHP code in file somefile.php.txt has worked in browser.

 

[chatwizrd]

Try order deny,allow

 

[Eremiya]

Try order deny,allow

Did not help.

 

[jackc]

no, look at this http://www.directadmin.com/forum/showthread.php?t=17248

 

[DirectAdmin Support]

Hello,

Thanks for pointing that out.
I've added the FilesMatch into the default httpd.conf for apache 1.3, as well as into the custombuild scripts with the dynamic config creations.

John